Security & privacy

Encryption

• TLS on every connection — web app and API. HSTS enabled; no plaintext fallback.
• Password-protected PDFs are unlocked in memory only — the password is never written to disk, logs, or the database.
• Your statement file is processed in memory. It is never written to disk.

Retention & deletion

• Statement files are not kept after the analysis finishes.
• The extracted result is saved for 24 hours, then deleted automatically. Delete it sooner from your dashboard.
• To delete your account and history, email support@bankstatementanalyser.com.
• We don't train models on your data or sell it, and our AI provider's terms exclude training on it.

Data handling

• Files are processed on our own servers. No advertising trackers on this site.
• AI is used only where it helps: reading a table our rules can't find, double-checking scanned rows and rows that don't reconcile, labelling hard-to-place transactions, a short memo, and open chat questions. Only the extracted text that step needs is sent — never the PDF itself.
• AI never overrides the math: any row it reads or corrects must still reconcile, or the file fails with an error.
• Totals, reconciliation, income, loan repayments and the fraud score are computed in our code, not by AI.
• We store your email and a salted, hashed password — never the password itself.
• Each saved result is tied to one account. No one else can open it.
• Hosting, AI, email and payment providers receive only what their job needs.

What we don't claim

• We're not a credit bureau and don't make lending decisions — you do, using these signals plus your own policy.
• We don't display certifications we haven't earned. No SOC 2 badge, no ISO logo.
• We don't offer an API or webhooks, and we keep no analysis history beyond the 24 hours described here.
• Read the output before you rely on it. Most anomalies have a perfectly ordinary explanation.